Analysis device, analysis method, and analysis program

Abstract

A classification unit classifies messages included in a text log depending on types, and gives an ID set for each type to each of the classified messages. A creation unit creates, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID. A pattern extraction unit extracts a plurality of patterns, which are combinations of the IDs, from the matrix created by the creation unit. A removal unit removes a part or whole of the patterns from the matrix. A determination unit calculates a degree of importance for each element included in each of the patterns, and determines whether the degree of importance is equal to or higher than a predetermined threshold. A sequence extraction unit extracts a sequence.

1 . An analysis device, comprising:
 a memory; and   a processor coupled to the memory and programmed to execute a process comprising:   classifying messages included in a text log output from a system for each type, and giving an ID set for each type to each of the classified messages;   creating, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID;   firstly extracting a plurality of patterns, which are combinations of the IDs, from the matrix created by the creating;   removing a part or whole of the patterns from the matrix;   calculating a degree of importance for each element included in each of the patterns, and determining whether the degree of importance is equal to or higher than a predetermined threshold; and   secondly extracting, from the text log, predetermined information on an element whose degree of importance has been determined by the determining to be equal to or higher than the predetermined threshold.   
     
     
         2 . The analysis device according to  claim 1 , wherein
 the calculating calculates the degree of importance for each ID included in each of the patterns, and the determining determines whether the degree of importance is equal to or higher than a predetermined threshold, and   the secondly extracting extracts a particular sequence from sequences indicating an order of appearance of IDs that have been determined by the determining to have the degree of importance equal to or higher than the predetermined threshold.   
     
     
         3 . An analysis device for decomposing an input matrix having item indices as items in each row and having instance indices as items in each column into a product of two matrices, the analysis device comprising: a memory; and a processor coupled to the memory and programmed to execute a process comprising:
 extracting a basis matrix in which column vectors are a plurality of patterns as combinations of the item indices and a weighting matrix in which weightings of the instance indices in each of the patterns are row vectors; and   calculating a degree of importance for each item index included in each of the patterns, and determining whether the degree of importance is equal to or higher than a predetermined threshold.   
     
     
         4 . The analysis device according to  claim 3 , wherein the calculating uses a value of an element for each item index in the basis matrix included in the pattern as the degree of importance, and uses, as the threshold, a threshold calculated by using Otsu's method based on values of elements for each of all item indices in the basis matrix included in the pattern. 
     
     
         5 . The analysis device according to  claim 3 , wherein the calculating calculates the degree of importance so as to be higher as a value of an element for each item index in the basis matrix in the pattern becomes higher and be lower as number of the patterns including item indices in the basis matrix becomes larger. 
     
     
         6 . The analysis device according to  claim 5 , wherein the calculating calculates a first threshold by using Otsu's method based on the value of the element for each item index in the basis matrix, and calculates the degree of importance for an item index whose value of the element is equal to or larger than the first threshold. 
     
     
         7 . The analysis device according to  claim 3 , wherein
 the extracting further extracts a value of an element in the pattern for each instance index in a predetermined weighting matrix, and   the calculating calculates a second degree of importance of the pattern for each instance index in the predetermined weighting matrix, and the determining further determines whether the second degree of importance is equal to or higher than a predetermined second threshold.   
     
     
         8 . The analysis device according to  claim 7 , wherein the calculating uses a value of an element in the pattern for each instance index in the predetermined weighting matrix as the second degree of importance, and uses, as the second threshold, a threshold calculated by using Otsu's method based on the value of the element. 
     
     
         9 . The analysis device according to  claim 7 , wherein the calculating calculates the second degree of importance so as to be higher as a value of an element of the pattern for each instance index in the predetermined weighting matrix becomes higher and be lower as number of the patterns having a value of an element of the instance index in the predetermined weighting matrix becomes larger. 
     
     
         10 . The analysis device according to  claim 9 , wherein the calculating calculates a third threshold by using Otsu's method based on a value of an element for each instance index in the predetermined weighting matrix, and calculates the second degree of importance for an instance index whose value of an element for each instance index in the predetermined weighting matrix is equal to or larger than the third threshold. 
     
     
         11 . An analysis device, comprising:
 a memory; and   a processor coupled to the memory and programmed to execute a process comprising:   classifying messages included in a text log output from a system for each type, and giving an ID set for each type to each of the classified messages;   creating, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID;   firstly extracting a plurality of patterns, which are combinations of the IDs, from the matrix created by the creating;   calculating a degree of importance for each ID included in each of the patterns, and determining whether the degree of importance is equal to or higher than a predetermined threshold;   generating a significant log by extracting, from a log obtained by replacing each message in the text log with an ID given by the giving, only an ID determined by the determining to be equal to or larger than the predetermined threshold; and   counting, from the generated significant log, number of appearances of each sequence indicating an order of appearance of IDs having a high degree of importance, and secondly extracting a sequence the number of appearances of which is equal to or larger than a predetermined threshold and which satisfies a predetermined condition.   
     
     
         12 . The analysis device according to  claim 11 , wherein
 the firstly extracting further extracts a degree of appearance of the pattern for each predetermined duration,   the calculating calculates a second degree of importance of the pattern for each predetermined duration, and the determining further determines whether the second degree of importance is equal to or higher than a predetermined second threshold, and   the generating generates a significant log by extracting only a predetermined duration determined by the determining to be equal to or larger than the predetermined second threshold.   
     
     
         13 . An analysis method to be executed by an analysis device, the analysis method comprising:
 classifying messages included in a text log output from a system for each type, and giving an ID set for each type to each of the classified messages;   creating, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID;   extracting a plurality of patterns, which are combinations of the IDs, from the matrix created at the creating;   removing a part or whole of the patterns from the matrix;   calculating a degree of importance for each element included in each of the patterns, and determining whether the degree of importance is equal to or higher than a predetermined threshold; and   extracting, from the text log, predetermined information on an element whose degree of importance has been determined at the determining to be equal to or higher than the predetermined threshold.   
     
     
         14 . An analysis method to be executed by an analysis device configured to decompose an input matrix having item indices as items in each row and having instance indices as items in each column into a product of two matrices, the analysis method comprising:
 extracting a basis matrix in which column vectors are a plurality of patterns as combinations of the item indices and a weighting matrix in which weighting of the instance indices in each of the patterns are row vectors;   calculating a degree of importance for each item index included in each of the patterns, and determining whether the degree of importance is equal to or higher than a predetermined threshold.   
     
     
         15 . An analysis method to be executed by an analysis device, the analysis method comprising:
 classifying messages included in a text log output from a system for each type, and giving an ID set for each type to each of the classified messages;   creating, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID;   extracting a plurality of patterns, which are combinations of the IDs, from the matrix created at the creating;   calculating a degree of importance for each ID included in each of the patterns, and determining whether the degree of importance is equal to or higher than a predetermined threshold;   generating, from a log obtained by replacing each message in the text log with an ID given at the classifying, a significant log by extracting only an ID determined at the determining to be equal to or larger than the predetermined threshold; and   counting, from the generated significant log, number of appearances of each sequence indicating an order of appearance of IDs having a high degree of importance, and extracting a sequence the number of appearances of which is equal to or larger than a predetermined threshold and which satisfies a predetermined condition.   
     
     
         16 . A non-transitory computer-readable recording medium having stored therein a program, for analysis, that causes a computer to execute a process comprising:
 classifying messages included in a text log output from a system for each type, and giving an ID set for each type to each of the classified messages;   creating, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID;   extracting a plurality of patterns, which are combinations of the IDs, from the matrix created at the creating;   removing a part or whole of the patterns from the matrix;   calculating a degree of importance for each element included in each of the patterns, and determining whether the degree of importance is equal to or higher than a predetermined threshold; and   extracting, from the text log, predetermined information on an element whose degree of importance has been determined at the determining to be equal to or higher than the predetermined threshold.   
     
     
         17 . A non-transitory computer-readable recording medium having stored therein a program, for analysis, that causes a computer configured to decompose an input matrix having item indices as items in each row and having instance indices as items in each column into a product of two matrices to execute a process comprising:
 extracting a basis matrix in which column vectors are a plurality of patterns as combinations of the item indices and a weighting matrix in which weighting of the instance indices in each of the patterns are row vectors;   calculating a degree of importance for each item index included in each of the patterns, and determining whether the degree of importance is equal to or higher than a predetermined threshold.   
     
     
         18 . A non-transitory computer-readable recording medium having stored therein a program, for analysis, that causes a computer to execute a process comprising:
 classifying messages included in a text log output from a system for each type, and giving an ID set for each type to each of the classified messages;   creating, based on dates of occurrence attached to the messages, a matrix indicating an appearance distribution of the messages in the text log for each predetermined duration for each ID;   extracting a plurality of patterns, which are combinations of the IDs, from the matrix created at the creating;   calculating a degree of importance for each ID included in each of the patterns, and determining whether the degree of importance is equal to or higher than a predetermined threshold;   generating, from a log obtained by replacing each message in the text log with an ID given at the classifying, a significant log by extracting only an ID determined at the determining to be equal to or larger than the predetermined threshold; and   counting, from the generated significant log, number of appearances of each sequence indicating an order of appearance of IDs having a high degree of importance, and extracting a sequence the number of appearances of which is equal to or larger than a predetermined threshold and which satisfies a predetermined condition.